Feat(webui): config.json/webui parity

[La-Volpe]

feat(settings): WebUI / config.json settings parity

TL;DR: Closes most of the gap between the WebUI settings panels and
config.json. New write endpoints for temperature, tool limits, dream,
channels, and memory fields, an expanded settings payload, and new UI
controls in Models, Agent limits, Memory, and Dream. 66 tests passing. A
Channels sidebar section and a raw config editor are intentionally left out,
pending discussion (see "What is NOT in this PR").

Summary

nanobot has two ways to configure the agent and they have not been in sync.:

1. the WebUI settings panels
2. path/to/.nanobot/config.json
   Dozens of fields that already existed in the config schema (temperature, max_tool_iterations, dream consolidation, channels behaviour, fallback_models,…) had no UI control and no write endpoint. Users (such as myself) either gave up or hand-edited JSON with no validation and no feedback.

This PR tries to narrow that gap across three layers mentioned below.

What changed

Layer 1: Backend write endpoints

nanobot/webui/settings_api.py

• update_agent_settings() now accepts nine new scalar fields:
  temperature, max_tokens, reasoning_effort, max_tool_iterations,
  max_concurrent_subagents, max_tool_result_chars, provider_retry_mode,
  unified_session, session_ttl_minutes
• update_agent_settings() also accepts five memory/session fields:
  max_messages, consolidation_ratio, context_block_limit,
  disabled_skills, fallback_models
• create_model_configuration() accepts caller-supplied overrides for
  temperature, max_tokens, reasoning_effort, context_window_tokens
  instead of always inheriting defaults
• update_model_configuration() accepts the same three generation fields
  per-preset
• New update_dream_settings(), a dedicated endpoint for
  dream.enabled, dream.interval_h, dream.model_override
• New update_channels_settings(), a dedicated endpoint for
  send_progress, send_tool_hints, show_reasoning,
  extract_document_text, send_max_retries
• update_network_safety_settings() now accepts restrict_to_workspace as
  a standalone param (previously required another field to be present);
  returns requires_restart: true when it changes, matching the security
  boundary documented in .agent/security.md

nanobot/webui/settings_routes.py

• New routes: POST /api/settings/dream/update,
  POST /api/settings/channels/update

Layer 2: Settings payload (GET /api/settings)

nanobot/webui/settings_api.py

• agent key gains 12 new fields covering behavior scalars and
  memory/session configuration
• New top-level channels key exposes all five channel behaviour fields
• advanced key now returns the full ssrf_whitelist list (previously
  count-only), plus exec_timeout, exec_allow_patterns,
  exec_deny_patterns
• runtime.dream expanded from { schedule } to
  { enabled, interval_h, model_override, schedule }, with schedule kept
  for backward compatibility

webui/src/lib/types.ts

• SettingsPayload.agent extended with all 12 new fields
• SettingsPayload.runtime.dream expanded
• New SettingsPayload.channels interface
• SettingsPayload.advanced extended with ssrf list + exec fields
• SettingsUpdate, ModelConfigurationCreate, ModelConfigurationUpdate
  extended with the new generation/behavior fields

Layer 3: WebUI controls

webui/src/lib/api.ts

• updateSettings() wires all new SettingsUpdate fields to query params
• createModelConfiguration() / updateModelConfiguration() wire the new
  generation fields
• New exported helpers: updateDreamSettings(), updateChannelsSettings()

webui/src/components/settings/SettingsView.tsx

• AgentSettingsDraft extended with 15 new fields; defaults and
  agentDraftFromPayload updated accordingly
• Models section: three new rows after Context window, namely Max tokens
  (number input), Temperature (range + number input), and Reasoning effort
  (segmented control)
• New collapsible sub-section, labeled Agent limits, below the Models save
  button, with Max tool iterations, Max concurrent subagents, Max tool
  result size, Retry mode, Unified session toggle, and Session timeout,
  each saved via its own button
• Runtime section: new Memory card (Max history messages, Consolidation
  ratio, Context block limit) and new Dream section (enabled toggle,
  interval, model override); Memory saves via updateSettings, Dream saves
  via updateDreamSettings
• New save handlers: saveBehaviorSettings, saveMemorySettings

Tests

tests/webui/test_settings_api.py

21 new test functions covering every new endpoint and payload field:
validation acceptance, out-of-range rejection, null/empty clearing,
payload default assertions, and requires_restart contracts.
All 66 tests pass.

What is NOT in this PR

Three items still need maintainer discussion before implementation, per
CONTRIBUTING.md:

• Raw config.json read and write endpoints
  (GET /api/settings/config/raw, POST /api/settings/config/raw/save)
• A new Channels sidebar section (a new SettingsSectionKey)
• A raw config editor in the Advanced section, which depends on the raw
  config endpoints above

Branch target

nightly, since all changes are new features or API surface additions.

Checklist

• pytest: 66/66 passed
• ruff check nanobot/: no new errors introduced
• ruff format: not run (.agent/gotchas.md explicitly prohibits it)
• No new dependencies added
• docs/configuration.md: to be updated in a follow-up once the
  Channels section and raw config editor land and the full settings
  surface is stable

[chengyongru]

This looks like a mistake. I will close this for now; feel free to mention me if you have any questions.

[La-Volpe]

@chengyongru

This looks like a mistake. I will close this for now; feel free to mention me if you have any questions.

In what sense is this a mistake? If you have something else in mind for the settings, I'd be happy to look into that :)

[chengyongru]

Hi @La-Volpe

This PR contains 151 commits and most of them are not related to this PR, so I closed it. 💖

Happy to reopen it if it is rebased on the latest origin/main . If everything is ready, feel free to @ me

see: https://github.com/HKUDS/nanobot/pull/4313/commits

[chengyongru]

@La-Volpe I re-target this pr to main, reopened

[La-Volpe]

@La-Volpe I re-target this pr to main, reopened

Thanks. I'll make sure it's correct branch next time 👍

[chengyongru]

Maintainer update: rebased this PR onto latest main and resolved the SettingsView import conflict. Verified with \python -m pytest tests/webui/test_settings_api.py -q\ (66 passed).

[chengyongru]

Maintainer update: trimmed unused settings surface from this PR. Removed the deferred Channels write endpoint/helper/tests and disabled/fallback write params that were not wired to the WebUI yet. Verified with python -m pytest tests/webui/test_settings_api.py -q (61 passed) and ruff check nanobot/webui/settings_api.py nanobot/webui/settings_routes.py tests/webui/test_settings_api.py.